Custom Search

Recover files with Photorec

Photorec is an extremely efficient software to recover deleted files or from a corrupted hard drive. It can gives pretty good results where testdisk fails.

What photorec can do

Algorithmic recovery, photorec is made to work even when the filesystem is too corrupted to be repaired. Instead, photorec analyse the whole surface of the hard drive and try to reconstruct files from an ocean of meaningless data. Since these analysis are very complex, they require to make your computer work intensively for sometime up to a full day.

Thousands of nameless files, since photorec recover files from scratch, these files have no name and you will recover huge amount of files, including files that you deleted years ago. You will have to browse inside all these files to be able to recover a particular file.

From a hard drive or a backup, photorec can also do the same operations on a file that contains a raw copy of a hard drive. Such files can be created with dd or ddrescue.

Ubuntu for good results

These instructions have been written for Ubuntu since it is the only universal operating system for that type of operation. It is the only one to be able to read and write on any hard drive and file system, even those of Windows and Mac. It is also the only one that you can boot from its bootable CD, on any computer even if the computer doesn't boot anymore because of a defect hard drive. And Ubuntu is very stable when working with hard disk failures.

You can use testdisk on Windows or Mac since a compatible version exist for these systems. However, you will not benefit from these advantages, which are required in most cases.

Prerequisities

Installation, To install photorec on Ubuntu, you must enable the universe repository and install testdisk package.

Directory tree, You must have an idea about what is a directory tree to know where are the files you are searching for and where you want to recover them. Think also about the trash if the file you want to recover could have been in it before being deleted.

Enough space, You also need to use another external hard drive, a USB stick or any other storage device with sufficient space for the files and folders you want to recover.

Exclusive access to the hard drive, it is always best to boot from the Ubuntu bootable CD or to connect the hard drive you want to analyse on a PC that is already booted on Ubuntu since it prevents softwares that are on that hard drive to start and read/write on it, photorec cannot reliably analyse a hard drive if its content is changing during the analysis. Neglecting this point may reduce the quality of results.

Proceed

  1. Open the Terminal, among the applications in the Ubuntu menu in the top left corner.
  2. Type sudo photorec to work with a real hard drive or type sudo photorec /location-of-the-backup-file to work with a raw backup file generated by dd or ddrescue. Press the Enter key on the keyboard. If asked, type your administrator password and press Enter. Testdisk might ask you to enlarge the size of the window.
  3. Hard drives are shown, it is possible to distinguish them with the size and the model name. Go on the hard drive you want to analyse and press Enter.
  4. You are asked for what is the partition table, for a normal PC it is always Intel. EFI GPT is for recent Apple Macs, Mac is for old PPC Mac, None is for USB stick and camera cards. Choose the right one and press Enter.
  5. With the arrow keys on the keyboad, move on File Opt (at the bottom) and press the Enter key.
  6. A list of file types is displayed, you can limit from there what photorec must recover. If you want to recover something specific, such as a Word document in doc format, you can uncheck all except doc. This filtering can allow you to eliminate already thousands of unnecessary files and speed up the analysis. Press s to select or deselect everything, use the arrows to move, press the spacebar to select or deselect a file type and press Enter when you are ready to proceed.
  7. A list of your hard drive partitions appears, you can use the arrows to choose a particular partition or else go on No partition (Whole disk) to scan your entier hard drive. With the arrow keys, go back on Search and press Enter.
  8. You are asked if the file system on the hard drive is ext2, ext3 or ext4, these are those used by Ubuntu and only a hard drive used by Ubuntu might be in one of these filesystems. Choose ext2/ext3 or Other to your own deductions and press Enter.
  9. You can choose between Free, which only scan the free space on a hard drive and only recover deleted files or Whole to scan the complete hard drive. Make your choice and press Enter.
  10. You are asked where to copy the files, you need to move up to the destination folder and press on U, you will need to know the path of that folder.
  11. The scan starts and progress is displayed. You can press Enter or Q at any time to stop it. Even if the computer is slow because of the analysis, you can immediately see the files that have been recovered yet in the destination folder.